Unauthorized Disclosure Notifications. In the event of an unauthorized disclosure of Pupil Records, the following process will be followed:
Unauthorized Disclosure Notifications. In the event of an unauthorized disclosure of a pupil’s records, affected Parents, legal guardians, or pupils who have reached the age of 18 will be notified through the following process: Immediately upon becoming aware of a compromise of pupil information, or of circumstances that could have resulted in an unauthorized access to or disclosure of pupil information, Agency and Vendor agree to notify the other party, fully investigate the incident and fully cooperate with the Agency’s investigation of the incident, remedial measures and respond in a timely manner. The notification as described above shall include: the nature of the unauthorized use or disclosure (e.g., security breach, nonconsensual re-disclosure, etc.); the specific pupil information that was used or disclosed without authorization; who made the unauthorized use or received the unauthorized disclosure (if known): what Vendor has done or will do to mitigate any effects of the unauthorized use or disclosure; and what corrective action Vendor has taken or will take to prevent future occurrences. Except as otherwise required by law, Vendor will not provide notice of the incident directly to the persons whose data were involved, regulatory agencies, or other entities, without prior written permission from Agency.
